VulnerabilityModified

CVE-2019-5736

HIGH 8.6EPSS 98.5%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 98.5%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

CVSS 3.1: 8.6 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS: 98.45% probability · 100th percentile
CISA KEV: Not listed
Weakness: CWE-78
Affected: docker/docker · linuxfoundation/runc · redhat/container development kit · redhat/openshift · redhat/enterprise linux · redhat/enterprise linux server · google/kubernetes engine · linuxcontainers/lxc · hp/onesphere · netapp/hci management node · netapp/solidfire · apache/mesos · opensuse/backports sle · opensuse/leap · d2iq/kubernetes engine · d2iq/dc\/os · fedoraproject/fedora · canonical/ubuntu linux · microfocus/service management automation
Source: cve@mitre.org

References

http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.htmlMailing List, Third Party Advisory
http://packetstormsecurity.com/files/163339/Docker-Container-Escape.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.htmlThird Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2019/03/23/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/06/28/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/07/06/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/07/06/4Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/10/24/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/10/29/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/01/31/6
http://www.openwall.com/lists/oss-security/2024/02/01/1
http://www.openwall.com/lists/oss-security/2024/02/02/3
http://www.securityfocus.com/bid/106976Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:0303Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0304Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0401Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0408Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0975Third Party Advisory
https://access.redhat.com/security/cve/cve-2019-5736Third Party Advisory
https://access.redhat.com/security/vulnerabilities/runcescapeThird Party Advisory
https://aws.amazon.com/security/security-bulletins/AWS-2019-002/Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.